Package-level declarations
Core resilience patterns: Bulkhead, Cache, CircuitBreaker (consecutive-failure and SlidingWindowCircuitBreaker failure-rate variants), RateLimiter, RetryRepeat (plus RetryBudget against retry storms), Saga, TimeLimiter, AdaptiveLimiter, Hedge, Failover (with active health-probing), and Chaos (fault-injection test helpers). Each with DSL builders and named registries. Policy composes patterns into reusable chains; FlowResilience provides Flow-native counterparts. SharedStateStore is an extension point for distributing state across instances. MicrometerBridge (JVM-only, optional) exports statistics as Micrometer gauges.
Types
AIMD-based adaptive concurrency limiter. See file-level docs for details.
Configuration for AdaptiveLimiter.
Builder for AdaptiveLimiterConfig.
Registry for managing multiple named adaptive limiters.
Snapshot of AdaptiveLimiter state.
Configuration for bulkhead behavior.
Builder for bulkhead configuration.
Exception thrown when the bulkhead is full.
Listener interface for bulkhead events.
Registry for managing named bulkhead instances.
Serializable mirror of BulkheadConfig.
Exception thrown when waiting for a bulkhead permit times out.
Configuration for cache behavior.
Builder for cache configuration.
Listener for cache events.
Registry for managing named cache instances.
Builder for ChaosConfig.
Thrown by chaos-wrapped operations when a simulated failure is injected.
Circuit breaker pattern to prevent cascading failures.
Configuration for circuit breaker behavior.
Builder for circuit breaker configuration.
Listener for circuit breaker state changes.
Exception thrown when circuit breaker is open.
Registry for managing multiple named circuit breakers.
Serializable mirror of CircuitBreakerConfig.
Circuit breaker state.
Statistics for a circuit breaker.
Information about a compensation error.
Isolation-by-dispatcher bulkhead: like Bulkhead, but every admitted call runs on a dedicated CoroutineDispatcher instead of the caller's context.
Cross-instance circuit breaker whose state lives in a SharedStateStore: when one instance trips the breaker, every instance sharing the store fails fast. Semantics follow CircuitBreaker (Closed → Open → HalfOpen), with CircuitBreakerConfig.halfOpenMaxCalls not enforced across processes.
Cross-instance fixed-window rate limiter whose counter lives in a SharedStateStore (e.g. a Redis-backed one), so every process sharing the store shares one budget of maxRequests per window.
Serializes Duration as whole milliseconds (a Long) for TimeLimiterStatistics. kotlin.time.Duration has no built-in @Serializable support at the kotlinx-serialization version this module targets, so statistics that carry a duration use this explicit serializer instead.
Reason an entry was evicted from the cache.
Strategy used to determine which cache entries to evict.
A single attempt recorded during Failover.execute: either a provider was skipped because its circuit was open, or it was invoked and failed.
Thrown by Failover.execute when every configured provider was either skipped (circuit open) or invoked and failed.
Invocation statistics for a single provider within a Failover, as of Failover.statistics.
Registry for managing multiple named Failover chains.
Configuration for the hedged-request pattern.
Single-process, STM-backed SharedStateStore implementation. Useful for tests and as a reference implementation — it does not coordinate across processes/machines.
A cache that automatically loads values on cache miss.
Binds resilience-pattern statistics to a Micrometer MeterRegistry as gauges.
Parallel saga coordinator for executing multiple sagas concurrently.
Result of parallel saga execution.
Token bucket rate limiter for controlling request throughput.
Configuration for rate limiter behavior.
Builder for rate limiter configuration.
Listener for rate limiter events.
Registry for managing multiple named rate limiters.
Serializable mirror of RateLimiterConfig.
Statistics for a rate limiter.
Exception thrown when rate limit is exceeded.
Declarative, externalizable configuration for named resilience instances (the application.yml-style equivalent of the programmatic DSLs).
Live, named resilience instances built from a ResilienceConfig.
Retry budget: a system-wide guard against retry storms.
Configuration for a RetryBudget.
Thrown by retryWithBudget when a retry would be warranted (the operation failed and attempts remain) but budget has no tokens left -- failing fast instead of piling onto a downstream that retries elsewhere in the system may already be overwhelming.
Result of a retry operation with history.
Builder for constructing a saga with multiple steps.
Configuration for saga execution behavior.
Registry for managing multiple named, reusable saga templates.
Result of saga execution.
Exception thrown when a saga step fails.
A minimal shared, string-keyed key-value store for cross-instance coordination of resilience state. See file-level docs for intended usage.
Sliding-window circuit breaker: trips on a failure rate over the last N calls, rather than CircuitBreaker's consecutive-failure count.
Configuration for SlidingWindowCircuitBreaker.
Builder for SlidingWindowCircuitBreakerConfig.
Registry for managing multiple named sliding-window circuit breakers.
Statistics for a SlidingWindowCircuitBreaker.
Configuration for sliding window rate limiter.
Sliding window rate limiter implementation.
Statistics for a sliding window rate limiter.
Thread-pool-isolation bulkhead (JVM). Admitted calls run on a dedicated fixed-size thread pool of BulkheadConfig.maxConcurrentCalls threads, so slow or blocking calls can never consume threads outside the pool.
Time limiter for enforcing execution timeouts.
Configuration for time limiter behavior.
Builder for time limiter configuration.
Listener for time limiter events.
Registry for managing multiple named time limiters.
Serializable mirror of TimeLimiterConfig.
Functions
DSL for creating a configured AdaptiveLimiter.
DSL for creating a configured Bulkhead instance.
Creates a circuit breaker with DSL-style configuration.
Executes a saga and returns the result.
Executes block using the hedged-request pattern: the primary attempt starts immediately, and up to HedgeConfig.maxHedges additional attempts start at increasing multiples of HedgeConfig.hedgeDelay if the previous attempts haven't completed yet. The first attempt to succeed wins; the rest are cancelled. If every attempt fails, the last failure is rethrown.
Executes block using the hedged-request pattern with named parameters instead of a HedgeConfig instance — convenient for one-off calls.
A Policy that runs the hedged-request pattern (see hedge): block may be started more than once, concurrently, after hedgeDelay (and again every hedgeDelay up to maxHedges times) if the earlier attempt(s) haven't completed yet, resolving to whichever attempt succeeds first. block must be safe to run multiple times concurrently (e.g. an idempotent GET).
Creates a rate limiter with DSL-style configuration.
A Policy that retries with exponential backoff and jitter like retryPolicy, but only for exceptions matching shouldRetry, backed by retryIfWithExponentialBackoff. Prefer this over retryPolicy whenever some failures are permanent (e.g. a 4xx response, a validation error) and shouldn't be retried at all.
Executes a suspend operation with retry using exponential backoff capped at a maximum delay, like retryWithCappedBackoff - but, unlike that, only for exceptions matching shouldRetry. Combines retryWithCappedBackoff's bounded backoff with retryIf's conditional retry.
Executes a suspend operation with retry using exponential backoff and jitter, but only for exceptions matching shouldRetry - combines retryWithExponentialBackoff's backoff strategy with retryIf's conditional retry, which neither function offers alone.
A Policy that retries with exponential backoff and jitter, backed by retryWithExponentialBackoff.
Like retryWithExponentialBackoff, but every retry (not the initial attempt) must first withdraw a token from budget -- see RetryBudget for why this matters. A successful call (whether on the first attempt or a later one) deposits a token back into the budget.
Executes a suspend operation with retry and collects detailed history of all attempts.
Creates a sliding-window circuit breaker with DSL-style configuration.
Creates a time limiter with DSL-style configuration.
Tries to execute an operation with bulkhead protection, returning null if rejected.
Executes an operation with bulkhead protection.
Executes an operation with bulkhead protection and a fallback for rejection.
Extension function to add timeout to any suspend function.
Inherited functions
Adapts this AdaptiveLimiter into a Policy.
Adapts this CircuitBreaker into a Policy.
Adapts this DispatcherBulkhead into a Policy.
Adapts this RateLimiter into a Policy.
Adapts this SlidingWindowCircuitBreaker into a Policy.
Adapts this SlidingWindowRateLimiter into a Policy.
Adapts this TimeLimiter into a Policy.
Retries collection of this Flow using exponential backoff with jitter, mirroring retryWithExponentialBackoff but for a whole flow instead of a single suspend call.
Protects collection of this Flow with a CircuitBreaker: if the breaker is open, collecting fails fast with CircuitBreakerOpenException instead of starting the upstream flow.
Protects collection of this Flow with a RateLimiter: acquiring permits tokens gates when collection of the upstream flow is allowed to start.
Bounds collection of this Flow with a TimeLimiter: if the whole collection doesn't complete within the timeout, it is cancelled.